How should organisations prepare for California-style AI governance requirements before a dedicated AI Act is finalised?

Organisations should inventory where automated decision systems are used, document the decisions they support, and map the data and risks tied to each use case. They should also assess alternatives, define oversight for high-stakes decisions, and create clear policies for transparency, notification, and human review. Early governance reduces compliance gaps when state and federal requirements tighten.

What California-Style AI Governance Is Really Asking Organisations To Do

These requirements are less about a single disclosure form and more about proving that AI-supported decisions are understood, owned, and reviewable. Organisations need a current inventory of automated decision use cases, a way to describe what each system decides, and a traceable link from the use case to the data, controls, and business owner behind it.

That matters because regulators rarely assess the model in isolation. They look at the decision context, the human oversight model, the data used, and whether the organisation can explain why the system is suitable for the outcome it influences. If those elements are undocumented, compliance gaps usually appear first as governance gaps.

A practical way to start is to classify use cases by decision impact, then separate low-risk internal automation from high-stakes workflows that affect customers, employees, credit, employment, housing, access, or other regulated outcomes. The governance burden rises quickly once a system materially influences a consequential decision, even if a human signs off later.

Building the Evidence Base Before the Law Catches Up

The strongest preparation is to build evidence before you are asked to produce it. That means documenting the decision purpose, data sources, retention assumptions, testing performed, escalation paths, and the criteria used to decide when a human must intervene. It also means identifying alternatives, because some governance regimes increasingly care whether a less intrusive or less opaque approach was considered.

Organisations should also treat transparency as an operational requirement, not a legal afterthought. If a person, customer, or employee can be affected by an automated decision, teams should already know what notice will be given, what explanation can be provided, and how a review request will be handled. Those decisions should be versioned and owned, not improvised after a complaint or audit request.

For teams that want a governance baseline, the NIST AI Risk Management Framework is a useful structure for organising roles, risk treatment, and accountability around AI systems. Where the programme extends into enterprise-wide AI operations, ISO/IEC 42001:2023 AI Management System Standard gives a management-system lens for repeatable governance rather than one-off compliance response.

Risk and Threat Considerations

California-style ai governance is most fragile where organisations cannot prove which data influenced a decision, who approved the use case, or when a human review is actually triggered. The biggest exposure is usually not a dramatic model failure, but a chain of undocumented assumptions that makes the decision hard to defend after the fact.

Failure mechanism: Hidden data lineage, weak ownership, and informal exceptions allow high-impact systems to be deployed without a reliable record of purpose, oversight, or reviewability. That creates audit gaps, unfairness risk, and remedial cost when the decision process is challenged.

Impact: Organisations can face delayed remediation, inconsistent customer handling, and governance findings that force a retrofit of policies, controls, and documentation across multiple teams at once.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST AI RMF, NIST CSF 2.0 and NIST SP 800-63 set the technical controls, while ISO/IEC 42001:2023 define the regulatory obligations.

Framework	Control / Reference	Relevance
NIST AI RMF	GOVERN — Govern	AI decision governance needs defined accountability and oversight.
Recommendation — Assign accountable owners and formal oversight for consequential AI decisions.
ISO/IEC 42001:2023	4.1 — Understanding the organization and its context	AI governance preparation depends on scoped use cases and business context.
	8.2 — AI risk treatment	Preparation requires documenting and treating risks tied to AI-supported decisions.
Recommendation — Map AI use cases to their business context and governance boundaries. Document AI risks and choose treatments before deployment.
NIST CSF 2.0	GV.RM-01 — Risk Management Strategy	Early AI governance should fit enterprise risk appetite and escalation paths.
Recommendation — Set risk thresholds and escalation paths for high-impact AI use cases.
NIST SP 800-63	IAL — Identity Assurance Level	High-stakes AI decisions often depend on trustworthy identity verification and review access.
Recommendation — Require stronger identity assurance where human review or approval gates AI outcomes.

Practitioner Guidance

What to prioritise: Start with the use cases that create external or employment-related impact, because those are the ones most likely to require notice, explanation, and human review discipline. If you can only mature one area first, make it decision inventory and ownership, since every later control depends on knowing what is in scope.

What to verify: Check that each governed use case has a named business owner, a written decision purpose, a defined review path, and a documented rationale for why automation is appropriate. If any of those are missing, treat the system as a governance gap rather than a mere documentation issue.

Common mistake: Teams often write policy before they can answer basic questions about which decisions are automated, which data fields are used, and who can override the outcome. That creates paperwork without control, which is the opposite of what early AI governance is meant to achieve.

Practitioner takeaway: The organisations that fare best are the ones that can explain the decision process before they are forced to defend it, because governance maturity is measured by evidence, not by intent.